Apparatus and method for detecting self-executable compressed file

Abstract

Provided are an apparatus and a method for detecting a self-executable compressed file by analyzing an executable program. The present invention firstly performs a static analysis on an executable file to search an executable file format, examines a section name part to determine whether the executable file format can be executable or not in compliance with a PE format standard based on a general PE file structure, and determines the executable file as a suspicious file if there is an abnormal section name or structure. Secondly, instructions are examined through disassembling in a section range where a corresponding executable file entry point exists if the suspicious part is found in the first analysis, and it is determined that the file is finally self-executable compressed if there is a file jumping from an address space of a section range where the entry point exists and jumping into a memory region of another section having read/write/execute characteristics. Accordingly, it can be determined whether variants of executable compression programs, file heads with modification and change, or files with unknown executable compression formats are self-executable compressed or not.

1 . An apparatus detecting whether an executable program is self-executable compressed or not according to an instruction provided from a key input part, the apparatus comprising:
 An abnormal Portable Executable (PE) file format detection module detecting whether a target file is executable in an executable file format, and examining a PE file section name and characteristics of a corresponding executable file;   an abnormal instruction analysis module analyzing an instruction on a section having an entry point of a suspicious executable file according to the analysis result of the abnormal PE file format detection module, in order to detect whether there an instruction jumping into a memory region of another section; and   an executable compression determination module determining that the target file is self-executable compressed if there is an instruction jumping into a memory region of another section according to the analysis result of the abnormal instruction analysis module.   
   
   
       2 . The apparatus of  claim 1 , wherein the target file is provided from an external storage according to an instruction of the key input part. 
   
   
       3 . The apparatus of  claim 1 , wherein the executable file format comprises an MZ header and a PE header. 
   
   
       4 . The apparatus of  claim 1 , wherein the suspicious executable file is an executable file having an executable file format in the target file. 
   
   
       5 . The apparatus of  claim 4 , wherein the executable file format comprises an MZ header and a PE header. 
   
   
       6 . The apparatus of  claim 1 , wherein the suspicious executable file is an executable file having an abnormal section name of a PE file of an executable file in the target file. 
   
   
       7 . The apparatus of  claim 1 , wherein the suspicious executable file is an executable file having at least two sections capable of read/write/execute characteristics in the target file. 
   
   
       8 . The apparatus of  claim 1 , wherein the instruction analysis is performed on a section having the entry point through disassembling. 
   
   
       9 . The apparatus of  claim 1 , wherein the memory region of another section comprises read/write/execute characteristics. 
   
   
       10 . A method for detecting whether an executable program is self-executable compressed or not according to an instruction provided from a key input part, the method comprising:
 detecting whether a target file is executable in an executable file format, and examining a PE file section name and characteristics of a corresponding executable file;   analyzing an instruction on a section having an entry point of a suspicious executable file according to the analysis result of the abnormal PE file format detection module, in order to detect whether there is an instruction jumping into a memory region of another section; and   determining that the target file is self-executable compressed if there is an instruction jumping into a memory region of another section according to the analysis result of the abnormal instruction analysis module.   
   
   
       11 . The apparatus of  claim 10 , wherein the executable file format comprises an MZ header and a PE header. 
   
   
       12 . The apparatus of  claim 10 , wherein the suspicious executable file is an executable file having an executable file format in the target file. 
   
   
       13 . The apparatus of  claim 12 , wherein the executable file format comprises an MZ header and a PE header. 
   
   
       14 . The apparatus of  claim 10 , wherein the suspicious executable file is an executable file having an abnormal section name of a PE file of an executable file in the target file. 
   
   
       15 . The apparatus of  claim 10 , wherein the suspicious executable file is an executable file having at least two sections capable of read/write/execute characteristics in the target file. 
   
   
       16 . The apparatus of  claim 10 , wherein the analysis of the instruction is performed on a section having the entry point through disassembling. 
   
   
       17 . The apparatus of  claim 10 , wherein the memory region of another section comprises read/write/execute characteristics.